EmailKit – Email Customizer for WooCommerce & WP

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   EmailKit – Email Customizer for WooCommerce & WP

Information

Software Type Plugin
Software Slug emailkit (view on wordpress.org)
Software Status Active
Software Author roxnor
Software Website wpmet.com
Software Downloads 508,147
Software Active Installs 80,000
Software Record Last Updated August 17, 2026

5 Vulnerabilities

Submit a Vulnerability
EmailKit <= 1.6.5 - Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameter
6.5
CVE-2026-5957
May 4, 2026
Researcher: Nguyen Cong Quang
EmailKit <= 1.6.3 - Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter
4.9
CVE-2026-3474
Mar 20, 2026
Researcher: Chiao-Lin Yu (Steven Meow)
EmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification
4.3
CVE-2026-1925
Feb 17, 2026
Researcher: Chiao-Lin Yu (Steven Meow)
EmailKit <= 1.6.1 - Authenticated (Author+) Arbitrary File Read via Path Traversal
6.5
CVE-2025-14059
Jan 6, 2026
Researcher: Dmitrii Ignatyev
EmailKit <= 1.6.0 - Missing Authorization to Authenticated (Author+) Arbitrary Content Deletion
4.3
CVE-2025-60106
Sep 26, 2025
Researcher: Denver Jackson
Title Status CVE ID CVSS Researchers Date
EmailKit <= 1.6.5 - Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameter Patched CVE-2026-5957 6.5 Nguyen Cong Quang May 4, 2026
EmailKit <= 1.6.3 - Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter Patched CVE-2026-3474 4.9 Chiao-Lin Yu (Steven Meow) March 20, 2026
EmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification Patched CVE-2026-1925 4.3 Chiao-Lin Yu (Steven Meow) February 17, 2026
EmailKit <= 1.6.1 - Authenticated (Author+) Arbitrary File Read via Path Traversal Patched CVE-2025-14059 6.5 Dmitrii Ignatyev January 6, 2026
EmailKit <= 1.6.0 - Missing Authorization to Authenticated (Author+) Arbitrary Content Deletion Patched CVE-2025-60106 4.3 Denver Jackson September 26, 2025

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation